[资料] 你的路由变砖了没？发个新点的tjtag工具，支持的cpu更多支持flash更多！

[复制链接]

zhshao521

1082 回帖	9888 积分	800 小时在线时间

中校

注册时间: 2009-6-19

金币: 8505 个

威望: 24 个

荣誉: 2 个

发消息

尚未签到

发表于 2010-6-23 11:29 |显示全部楼层

本帖最后由 zhshao521 于 2010-6-23 12:11 编辑

赚点黑钱嘿嘿！tjtag3-0-1下载！
支持33种型号的cpu！
支持106种型号的flash！
Microsoft Windows [版本 5.2.3790]
(C) 版权所有 1985-2003 Microsoft Corp.
C:\Documents and Settings\Administrator>cd\
C:\>tjtag
==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================
ABOUT: This program reads/writes flash memory on the WRT54G/GS and
      compatible routers via EJTAG using either DMA Access routines
      or PrAcc routines (slower/more compatible).  Processor chips
      supported in this version include the following chips:
         Supported Chips
         ---------------
         Broadcom BCM4702 Rev 1 CPU
         Broadcom BCM4704 KPBG Rev 9 CPU
         Broadcom BCM4704 Rev 8 CPU
         Broadcom BCM4712 Rev 1 CPU
         Broadcom BCM4712 Rev 2 CPU
         Broadcom BCM4716 Rev 1 CPU
         Broadcom BCM4785 Rev 1 CPU
         Broadcom BCM5350 Rev 1 CPU
         Broadcom BCM5352 Rev 1 CPU
         Broadcom BCM5354 KFBG Rev 1 CPU
         Broadcom BCM5354 KFBG Rev 2 CPU
         Broadcom BCM5354 KFBG Rev 3 CPU
         Broadcom BCM3345 KPB Rev 1 CPU
         Broadcom BCM5365 Rev 1 CPU
         Broadcom BCM5365 Rev 1 CPU
         Broadcom BCM6345 Rev 1 CPU
         Broadcom BCM6348 Rev 1 CPU
         Broadcom BCM6338 Rev 1 CPU
         Broadcom BCM6358 Rev 1 CPU
         Broadcom BCM6368 Rev 1 CPU
         Broadcom BCM4321 RADIO STOP
         Broadcom BCM4321L RADIO STOP
         TI AR7WRD TNETD7300GDU Rev 1 CPU
         BRECIS MSP2007-CA-A1 CPU
         TI TNETV1060GDW CPU
         Linkstation 2 with RISC K4C chip
         Atheros AR531X/231X CPU
         XScale IXP42X 266mhz
         XScale IXP42X 400mhz
         XScale IXP42X 533mhz
         ARM 940T
         Marvell Feroceon 88F5181
         LX4380

USAGE: tjtag [parameter] </noreset> </noemw> </nocwd> </nobreak> </noerase>
                  </notimestamp> </dma> </nodma>
                  <start:XXXXXXXX> </length:XXXXXXXX>
                  </silent> </skipdetect> </instrlen:XX> </fc:XX> /bypass /s
t5
         Required Parameter
         ------------------
         -backup:cfe
         -backup:nvram
         -backup:kernel
         -backup:wholeflash
         -backup:custom
         -backup:bsp
         -erase:cfe
         -erase:nvram
         -erase:kernel
         -erase:wholeflash
         -erase:custom
         -erase:bsp
         -flash:cfe
         -flash:nvram
         -flash:kernel
         -flash:wholeflash
         -flash:custom
         -flash:bsp
         -probeonly
         -probeonly:custom
               Optional with -backup:, -erase:, -flash: wgrv8bdata, wgrv9bdata
, cfe128
         Optional Switches
         -----------------
         /noreset ........... prevent Issuing EJTAG CPU reset
         /noemw ............. prevent Enabling Memory Writes
         /nocwd ............. prevent Clearing CPU Watchdog Timer
         /nobreak ........... prevent Issuing Debug Mode JTAGBRK
         /noerase ........... prevent Forced Erase before Flashing
         /notimestamp ....... prevent Timestamping of Backups
         /dma ............... force use of DMA routines
         /nodma ............. force use of PRACC routines (No DMA)
         /window:XXXXXXXX ... custom flash window base (in HEX)
         /start:XXXXXXXX .... custom start location (in HEX)
         /length:XXXXXXXX ... custom length (in HEX)
         /silent ............ prevent scrolling display of data
         /skipdetect ........ skip auto detection of CPU Chip ID
         /instrlen:XX ....... set instruction length manually
         /wiggler ........... use wiggler cable
         /bypass ............ Unlock Bypass command & disable polling
         /st5 ............... Use Speedtouch ST5xx flash routines instead of
WRT routines
         /reboot............. sets the process and reboots
               /swap_endian........ swap endianess during backup - most Athero
s based routers
               /flash_debug........ flash chip debug messages, show flash MFG
and Device ID
         /fc:XX = Optional (Manual) Flash Chip Selection
         -----------------------------------------------
         /fc:01 ............. MX29LV800BTC 512kx16 TopB  (1MB)
         /fc:02 ............. MX29LV800BTC 512kx16 BotB  (1MB)
         /fc:03 ............. AMD 29lv160DB 1Mx16 BotB (2MB)
         /fc:04 ............. AMD 29lv160DT 1Mx16 TopB (2MB)
         /fc:05 ............. EON EN29LV160A 1Mx16 BotB  (2MB)
         /fc:06 ............. EON EN29LV160A 1Mx16 TopB  (2MB)
         /fc:07 ............. MBM29LV160B 1Mx16 BotB    (2MB)
         /fc:08 ............. MBM29LV160T 1Mx16 TopB    (2MB)
         /fc:09 ............. MX29LV160CB 1Mx16 BotB    (2MB)
         /fc:10 ............. MX29LV160CT 1Mx16 TopB    (2MB)
         /fc:11 ............. K8D1716UTC  1Mx16 TopB    (2MB)
         /fc:12 ............. K8D1716UBC  1Mx16 BotB    (2MB)
         /fc:13 ............. ST M29W160EB 1Mx16 BotB (2MB)
         /fc:14 ............. ST M29W160ET 1Mx16 TopB (2MB)
         /fc:15 ............. Macronix MX25L160A       (2MB) Serial
         /fc:16 ............. Atmel AT45DB161B          (2MB) Serial
         /fc:17 ............. Atmel AT45DB161B          (2MB) Serial
         /fc:18 ............. K8D3216UTC  2Mx16 TopB    (4MB)
         /fc:19 ............. K8D3216UBC  2Mx16 BotB    (4MB)
         /fc:20 ............. Macronix MX25L1605D       (2MB) Serial
         /fc:21 ............. Macronix MX25L3205D       (4MB) Serial
         /fc:22 ............. Macronix MX25L6405D       (8MB) Serial
         /fc:23 ............. STMicro M25P16          (2MB) Serial
         /fc:24 ............. STMicro M25P32          (4MB) Serial
         /fc:25 ............. STMicro M25P64          (8MB) Serial
         /fc:26 ............. STMicro M25P128          (16MB) Serial
         /fc:27 ............. AMD 29lv320MB 2Mx16 BotB (4MB)
         /fc:28 ............. AMD 29lv320MT 2Mx16 TopB (4MB)
         /fc:29 ............. AMD 29lv320MT 2Mx16 TopB (4MB)
         /fc:30 ............. TC58FVB321 2Mx16 BotB    (4MB)
         /fc:31 ............. TC58FVT321 2Mx16 TopB    (4MB)
         /fc:32 ............. AT49BV/LV16X 2Mx16 BotB (4MB)
         /fc:33 ............. AT49BV/LV16XT 2Mx16 TopB (4MB)
         /fc:34 ............. MBM29DL323BE 2Mx16 BotB (4MB)
         /fc:35 ............. MBM29DL323TE 2Mx16 TopB (4MB)
         /fc:36 ............. AMD 29lv320DB 2Mx16 BotB (4MB)
         /fc:37 ............. AMD 29lv320DT 2Mx16 TopB (4MB)
         /fc:38 ............. MBM29LV320BE 2Mx16 BotB (4MB)
         /fc:39 ............. MBM29LV320TE 2Mx16 TopB (4MB)
         /fc:40 ............. MX29LV320B 2Mx16 BotB    (4MB)
         /fc:41 ............. MX29LV320B 2Mx16 BotB    (4MB)
         /fc:42 ............. MX29LV320T 2Mx16 TopB    (4MB)
         /fc:43 ............. MX29LV320T 2Mx16 TopB    (4MB)
         /fc:44 ............. ST 29w320DB 2Mx16 BotB    (4MB)
         /fc:45 ............. ST 29w320DT 2Mx16 TopB    (4MB)
         /fc:46 ............. MX29LV640B 4Mx16 TopB    (16MB)
         /fc:47 ............. MX29LV640B 4Mx16 BotB    (16MB)
         /fc:48 ............. W19B(L)320ST 2Mx16 TopB  (4MB)
         /fc:49 ............. W19B(L)320SB 2Mx16 BotB  (4MB)
         /fc:50 ............. W19B(L)320SB 2Mx16 BotB  (4MB)
         /fc:51 ............. M29DW324DT 2Mx16 TopB    (4MB)
         /fc:52 ............. M29DW324DB 2Mx16 BotB    (4MB)
         /fc:53 ............. TC58FVM6T2A  4Mx16 TopB (8MB)
         /fc:54 ............. TC58FVM6B2A  4Mx16 BopB (8MB)
         /fc:55 ............. K8D6316UTM  4Mx16 TopB    (8MB)
         /fc:56 ............. K8D6316UBM  4Mx16 BotB    (8MB)
         /fc:57 ............. Intel 28F160B3 1Mx16 BotB  (2MB)
         /fc:58 ............. Intel 28F160B3 1Mx16 TopB  (2MB)
         /fc:59 ............. Intel 28F160C3 1Mx16 BotB  (2MB)
         /fc:60 ............. Intel 28F160C3 1Mx16 TopB  (2MB)
         /fc:61 ............. Intel 28F320B3 2Mx16 BotB  (4MB)
         /fc:62 ............. Intel 28F320B3 2Mx16 TopB  (4MB)
         /fc:63 ............. Intel 28F320C3 2Mx16 BotB  (4MB)
         /fc:64 ............. Intel 28F320C3 2Mx16 TopB  (4MB)
         /fc:65 ............. Sharp 28F320BJE 2Mx16 BotB (4MB)
         /fc:66 ............. Intel 28F640B3 4Mx16 BotB  (8MB)
         /fc:67 ............. Intel 28F640B3 4Mx16 TopB  (8MB)
         /fc:68 ............. Intel 28F640C3 4Mx16 BotB  (8MB)
         /fc:69 ............. Intel 28F640C3 4Mx16 TopB  (8MB)
         /fc:70 ............. Intel 28F160S3/5 1Mx16    (2MB)
         /fc:71 ............. Intel 28F320J3 2Mx16    (4MB)
         /fc:72 ............. Intel 28F320J5 2Mx16    (4MB)
         /fc:73 ............. Intel 28F320S3/5 2Mx16    (4MB)
         /fc:74 ............. Intel 28F640J3 4Mx16    (8MB)
         /fc:75 ............. Intel 28F640J5 4Mx16    (8MB)
         /fc:76 ............. Intel 28F128J3 8Mx16    (16MB)
         /fc:77 ............. SST39VF1601 1Mx16 BotB    (2MB)
         /fc:78 ............. SST39VF1602 1Mx16 TopB    (2MB)
         /fc:79 ............. SST39VF3201 2Mx16 BotB    (4MB)
         /fc:80 ............. SST39VF3202 2Mx16 TopB    (4MB)
         /fc:81 ............. SST39VF6401 4Mx16 BotB    (8MB)
         /fc:82 ............. SST39VF6402 4Mx16 TopB    (8MB)
         /fc:83 ............. SST39VF6401B 4Mx16 BotB (8MB)
         /fc:84 ............. SST39VF6402B 4Mx16 TopB (8MB)
         /fc:85 ............. Spansion S29GL032M BotB (4MB)
         /fc:86 ............. Spansion S29GL032M TopB (4MB)
         /fc:87 ............. Spansion S29GL064M BotB (8MB)
         /fc:88 ............. Spansion S29GL064M TopB (8MB)
         /fc:89 ............. Spansion S29GL128P U    (16MB)
         /fc:90 ............. Spansion S29GL128M U    (16MB)
         /fc:91 ............. Spansion S29GL256P U    (32MB)
         /fc:92 ............. Spansion S29GL512P U    (64MB)
         /fc:93 ............. Spansion S29GL01GP U    (128MB)
         /fc:94 ............. Spansion S25FL016A       (2MB) Serial
         /fc:95 ............. Spansion S25FL032A       (4MB) Serial
         /fc:96 ............. Spansion S25FL064A       (8MB) Serial
         /fc:97 ............. Winbond W19B320AB BotB    (4MB)
         /fc:98 ............. Winbond W19B320AT TopB    (4MB)
         /fc:99 ............. Winbond W25X32          (4MB) Serial
         /fc:100 ............. Winbond W25X64          (8MB) Serial
         /fc:101 ............. EON EN29LV320 2Mx16 BotB (4MB)
         /fc:102 ............. EON EN29LV320 2Mx16 TopB (4MB)
         /fc:103 ............. EON EN29LV640 4Mx16 TopB (8MB)
         /fc:104 ............. EON EN29LV640 4Mx16 BotB (8MB)
         /fc:105 ............. AT49BV322A 2Mx16 BotB    (4MB)
         /fc:106 ............. AT49BV322A(T) 2Mx16 TopB (4MB)

NOTES: 1) If 'flashing' - the source filename must exist as follows:
         CFE.BIN, NVRAM.BIN, KERNEL.BIN, WHOLEFLASH.BIN or CUSTOM.BIN
         BSP.BIN
      2) If you have difficulty auto-detecting a particular flash part
         you can manually specify your exact part using the /fc:XX option.
      3) If you have difficulty with the older bcm47xx chips or when no CFE
         is currently active/operational you may want to try both the
         /noreset and /nobreak command line options together.  Some bcm47xx
         chips *may* always require both these options to function properly.
      4) When using this utility, usually it is best to type the command line
         out, then plug in the router, and then hit <ENTER> quickly to avoid
         the CPUs watchdog interfering with the EJTAG operations.
      5) /bypass - enables Unlock bypass command for some AMD/Spansion type
         flashes, it also disables polling
***************************************************************************
* Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG *
* via this utility.  You are better off flashing the CFE & NVRAM files *
* & then using the normal TFTP method to flash the KERNEL via ethernet. *
***************************************************************************

C:\>tjtag -erase:nvram
==============================================
EJTAG Debrick Utility v3.0.1 Tornado-MOD
==============================================
Probing bus ... Done
Instruction Length set to 8
CPU Chip ID: 00110101001101010100000101111111 (3535417F)
*** Found a Broadcom BCM5354 KFBG Rev 3 CPU chip ***
- EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS16 MIPS32
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <

rocessor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ...
Done
*** Unknown or NO Flash Chip Detected ***
*** REQUESTED OPERATION IS COMPLETE ***

C:\>
本贴目的是以交流学习为主，也希望能有高手帮我解决不识别我的flash问题！
可惜了就是不认识我这种型号的flash！
再发个做jtag跳线的图片：
本贴是以LinksysWrt54g一款ap为例不同的路由jtag是不一样的

使用tjtag工具之前准备工作：

硬件连接好之后接下来来软的。具体步骤如下:第一件事是重启电脑，然后进入bios确认并口的模式：工作状态选择：ECP，中断选择：378，保存后重启。这步应该可以省，因为一般电脑的BIOS默认就是以上的工作状态。

1)把下载下来的“JTAG.rar”里面的JTAG文件夹解压到C般跟目录。

2）选择“开始”-“运行”，写入“%systemroot%\system32\drivers\”回车后系统将会打开一个文件夹，将“C:\jtag”目录里面的“giveio.sys”复制进去。

3）运行“C:\jtag”目录中的“loaddrv.exe”，在路径中填写“c:\windows\system32\drivers\giveio.sys”。（4和5步在下面的图中已说明）

6）选择“开始”-“运行”，写入“cmd”回车，在弹出的对话框中输入下列命令：

******************************************************************************

cd c:\jtag回车。下面是我们常用的命令：

tjtag -backup:nvram
备份nvram，备份的nvram会生成在JTAG文件夹里。

tjtag -erase:nvram
清除nvram，这就是我们常用的。

tjtag -flash:nvram
写入nvram,待写入的nvram要放在JTAG文件夹里并更名为“NVRAM.BIN”这个一般不会用到，因为我会清除NVRAM之后，CFE会自动重建默认的NVRAM。